Commit 76a92be5 authored by Larry Finger's avatar Larry Finger Committed by John W. Linville

rtlwifi: rtl8192c_common: rtl8192de: Check for allocation failures

In https://bugzilla.redhat.com/show_bug.cgi?id=771656, a kernel bug was
triggered due to a failed skb allocation that was not checked. This event
lead to an audit of all memory allocations in the complete rtlwifi family
of drivers. This patch fixes the rest.
Signed-off-by: default avatarLarry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 39d02a7d
...@@ -652,6 +652,8 @@ static void _rtl_receive_one(struct ieee80211_hw *hw, struct sk_buff *skb, ...@@ -652,6 +652,8 @@ static void _rtl_receive_one(struct ieee80211_hw *hw, struct sk_buff *skb,
return; return;
uskb = dev_alloc_skb(skb->len + 128); uskb = dev_alloc_skb(skb->len + 128);
if (!uskb)
return; /* exit if allocation failed */
memcpy(IEEE80211_SKB_RXCB(uskb), &rx_status, sizeof(rx_status)); memcpy(IEEE80211_SKB_RXCB(uskb), &rx_status, sizeof(rx_status));
pdata = (u8 *)skb_put(uskb, skb->len); pdata = (u8 *)skb_put(uskb, skb->len);
memcpy(pdata, skb->data, skb->len); memcpy(pdata, skb->data, skb->len);
......
...@@ -785,6 +785,8 @@ void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool dl_finished) ...@@ -785,6 +785,8 @@ void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool dl_finished)
skb = dev_alloc_skb(totalpacketlen); skb = dev_alloc_skb(totalpacketlen);
if (!skb)
return;
memcpy((u8 *) skb_put(skb, totalpacketlen), memcpy((u8 *) skb_put(skb, totalpacketlen),
&reserved_page_packet, totalpacketlen); &reserved_page_packet, totalpacketlen);
......
...@@ -756,12 +756,16 @@ void rtl92d_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool dl_finished) ...@@ -756,12 +756,16 @@ void rtl92d_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool dl_finished)
"rtl92d_set_fw_rsvdpagepkt(): HW_VAR_SET_TX_CMD: ALL", "rtl92d_set_fw_rsvdpagepkt(): HW_VAR_SET_TX_CMD: ALL",
u1RsvdPageLoc, 3); u1RsvdPageLoc, 3);
skb = dev_alloc_skb(totalpacketlen); skb = dev_alloc_skb(totalpacketlen);
memcpy((u8 *) skb_put(skb, totalpacketlen), &reserved_page_packet, if (!skb) {
totalpacketlen); dlok = false;
} else {
memcpy((u8 *) skb_put(skb, totalpacketlen),
&reserved_page_packet, totalpacketlen);
rtstatus = _rtl92d_cmd_send_packet(hw, skb); rtstatus = _rtl92d_cmd_send_packet(hw, skb);
if (rtstatus) if (rtstatus)
dlok = true; dlok = true;
}
if (dlok) { if (dlok) {
RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
"Set RSVD page location to Fw\n"); "Set RSVD page location to Fw\n");
......
...@@ -520,12 +520,14 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw *hw, ...@@ -520,12 +520,14 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw *hw,
u8 *pdata; u8 *pdata;
uskb = dev_alloc_skb(skb->len + 128); uskb = dev_alloc_skb(skb->len + 128);
if (uskb) { /* drop packet on allocation failure */
memcpy(IEEE80211_SKB_RXCB(uskb), &rx_status, memcpy(IEEE80211_SKB_RXCB(uskb), &rx_status,
sizeof(rx_status)); sizeof(rx_status));
pdata = (u8 *)skb_put(uskb, skb->len); pdata = (u8 *)skb_put(uskb, skb->len);
memcpy(pdata, skb->data, skb->len); memcpy(pdata, skb->data, skb->len);
dev_kfree_skb_any(skb);
ieee80211_rx_irqsafe(hw, uskb); ieee80211_rx_irqsafe(hw, uskb);
}
dev_kfree_skb_any(skb);
} else { } else {
dev_kfree_skb_any(skb); dev_kfree_skb_any(skb);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment